@kontourai/flow-agents 3.8.0 → 3.10.0

package/evals/fixtures/telemetry/usage-transcript-oversized-tokens.jsonl

@@ -0,0 +1 @@
+{"type": "assistant", "message": {"model": "claude-opus-4-8", "usage": {"input_tokens": 1e+308, "output_tokens": 20, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0}}}

package/evals/fixtures/telemetry/usage-transcript-prefixed-secret-lower.jsonl

@@ -0,0 +1 @@
+{"type":"assistant","message":{"model":"claude-abcdefghijklmnopqrstuvwxyz0","usage":{"input_tokens":13,"output_tokens":26,"cache_creation_input_tokens":0,"cache_read_input_tokens":0}}}

package/evals/fixtures/telemetry/usage-transcript-prefixed-secret-upper.jsonl

@@ -0,0 +1 @@
+{"type":"assistant","message":{"model":"claude-UPPERCASE-REJECTED","usage":{"input_tokens":11,"output_tokens":22,"cache_creation_input_tokens":0,"cache_read_input_tokens":0}}}

package/evals/fixtures/telemetry/usage-transcript-secret-model-jwt.jsonl

@@ -0,0 +1 @@
+{"type": "assistant", "message": {"model": "not-a-real-jwt.payload-user-at-example-com.sig", "usage": {"input_tokens": 30, "output_tokens": 9, "cache_creation_input_tokens": 1, "cache_read_input_tokens": 2}}}

package/evals/fixtures/telemetry/usage-transcript-secret-model.jsonl

@@ -0,0 +1 @@
+{"type": "assistant", "message": {"model": "sk-ant-api03-abcDEF123456789_secretlookingkey-XYZ", "usage": {"input_tokens": 42, "output_tokens": 17, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0}}}

package/evals/fixtures/telemetry/usage-transcript-torn-trailing.jsonl

@@ -0,0 +1,2 @@
+{"type": "assistant", "message": {"model": "claude-torn-trailing-safe", "usage": {"input_tokens": 15, "output_tokens": 25, "cache_creation_input_tokens": 1, "cache_read_input_tokens": 2}}}
+{"type":"assistant","message":{"model":"claude-torn-victim","usage":{"input_tokens":999,"output_tok

package/evals/integration/test_actor_identity.sh

@@ -245,6 +245,69 @@ else
   _fail "resolveActor did not honor a deliberate literal FLOW_AGENTS_ACTOR=unknown override"
 fi
 
+# 11 (#554). CODEX_THREAD_ID is the preferred native Codex signal. Its raw value must never
+# become durable actor text: it is transformed into a stable, domain-separated 96-bit token.
+if node - "$MODULE" <<'NODE'
+const path = process.argv[2];
+const { detectRuntime, runtimeSessionId, resolveActor, resolveActorIdentity, serializeActor } = require(path);
+const rawA = "thread:private/value\nwith-control";
+const rawB = "thread:other-private-value";
+const envA = { CODEX_THREAD_ID: rawA, CODEX_SESSION_ID: "legacy-must-lose" };
+if (detectRuntime(envA) !== "codex") throw new Error("CODEX_THREAD_ID did not detect codex");
+if (runtimeSessionId(envA) !== rawA) throw new Error("CODEX_THREAD_ID did not win ordered priority");
+if (runtimeSessionId({ CODEX_SESSION_ID: "legacy-ok" }) !== "legacy-ok") throw new Error("legacy CODEX_SESSION_ID stopped working");
+const first = resolveActor(envA);
+const repeat = resolveActor(envA);
+const distinct = resolveActor({ CODEX_THREAD_ID: rawB });
+const identity = resolveActorIdentity(envA);
+if (JSON.stringify(first) !== JSON.stringify(repeat)) throw new Error("same thread was unstable");
+if (first.actor === distinct.actor) throw new Error("distinct threads collided");
+if (first.source !== "runtime-session-id:codex") throw new Error(`wrong source: ${JSON.stringify(first)}`);
+if (!identity.actorStruct || identity.actor !== serializeActor(identity.actorStruct)) throw new Error("canonical actor struct/key diverged");
+if (identity.actorStruct.session_id.includes("private")) throw new Error("raw id leaked through canonical actor struct");
+if (!/^codex:thread-[a-f0-9]{24}:[A-Za-z0-9_.-]+$/.test(first.actor)) throw new Error(`unsafe actor shape: ${JSON.stringify(first)}`);
+if (first.actor.includes(rawA) || first.actor.includes("private") || first.actor.includes("legacy-must-lose")) throw new Error("raw native id leaked");
+NODE
+then
+  _pass "CODEX_THREAD_ID yields a stable, distinct, privacy-safe Codex actor and wins over the legacy signal"
+else
+  _fail "CODEX_THREAD_ID native identity contract failed"
+fi
+
+# 12 (#554). Ancestry is explicitly classified in its display string but remains unstable by source.
+if node - "$MODULE" <<'NODE'
+const path = process.argv[2];
+const { resolveActorIdentity, serializeActor } = require(path);
+const out = resolveActorIdentity({});
+if (!out || out.source !== "process-ancestry") throw new Error(`wrong fallback source: ${JSON.stringify(out)}`);
+if (!out.actor.startsWith("process-ancestry:anc-")) throw new Error(`fallback remains misleading: ${JSON.stringify(out)}`);
+if (out.actor.startsWith("unknown:anc-")) throw new Error(`legacy fallback still emitted: ${JSON.stringify(out)}`);
+if (!out.actorStruct || out.actorStruct.runtime !== "process-ancestry" || out.actor !== serializeActor(out.actorStruct)) throw new Error(`fallback struct/key diverged: ${JSON.stringify(out)}`);
+NODE
+then
+  _pass "ancestry fallback is explicitly labeled process-ancestry without changing its source classification"
+else
+  _fail "ancestry fallback label/source contract failed"
+fi
+
+# 13 (#554). Historical actor values remain opaque and readable; no alias/schema rewrite is needed.
+if node - "$ROOT/scripts/hooks/lib/liveness-read.js" <<'NODE'
+const { freshHolders } = require(process.argv[2]);
+const legacy = "unknown:anc-eabf4cb9ef38:old-host";
+const at = "2026-07-11T12:00:00.000Z";
+const events = [{ type: "claim", subjectId: "legacy-work", actor: legacy, at, ttlSeconds: 1800 }];
+const foreign = freshHolders(events, "legacy-work", "new-self", Date.parse(at) + 1000);
+const self = freshHolders(events, "legacy-work", legacy, Date.parse(at) + 1000);
+if (foreign.length !== 1 || foreign[0].actor !== legacy) throw new Error(`legacy record unreadable: ${JSON.stringify(foreign)}`);
+if (self.length !== 0) throw new Error(`legacy self-filter failed: ${JSON.stringify(self)}`);
+if (events[0].actor !== legacy || Object.prototype.hasOwnProperty.call(events[0], "actor_key")) throw new Error("legacy record was mutated");
+NODE
+then
+  _pass "legacy unknown:anc-* records remain readable, self-filterable, and unmodified"
+else
+  _fail "legacy unknown:anc-* compatibility failed"
+fi
+
 if [[ "$errors" -eq 0 ]]; then
   echo "Actor identity resolver integration passed."
   exit 0

package/evals/integration/test_assignment_provider_local_file.sh

@@ -268,6 +268,40 @@ fi
 [[ "$(json_query "$TMPDIR_EVAL/status-race.json" "assignment.assignee")" == "$EXPECTED_RACE_HOLDER" ]] && pass "on-disk record holder matches the process that actually exited 0 (no silent overwrite by the loser)" || fail "on-disk record holder matches the process that actually exited 0 (no silent overwrite by the loser)"
 
 echo ""
+
+# 8. #554: auto-derived Codex identity persists only the canonical privacy-safe struct/key.
+CODEX_ROOT="$TMPDIR_EVAL/codex-artifact-root"
+CODEX_SUBJECT="codex-private-identity"
+CODEX_RAW='PRIVATE-SENTINEL:thread/value-with-punctuation'
+CODEX_THREAD_ID="$CODEX_RAW" CODEX_SESSION_ID= node "$CLI" assignment-provider claim \
+  --provider local-file --artifact-root "$CODEX_ROOT" --subject-id "$CODEX_SUBJECT" \
+  --branch agent/codex-private --artifact-dir .kontourai/flow-agents/codex-private \
+  >"$TMPDIR_EVAL/codex-claim.json" 2>"$TMPDIR_EVAL/codex-claim.err"
+CODEX_RECORD="$CODEX_ROOT/assignment/$CODEX_SUBJECT.json"
+if node - "$CODEX_RECORD" "$ROOT/scripts/hooks/lib/actor-identity.js" <<'NODE'
+const fs = require('fs');
+const record = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+const { serializeActor } = require(process.argv[3]);
+if (record.actor.runtime !== 'codex') throw new Error('wrong runtime');
+if (!/^thread-[a-f0-9]{24}$/.test(record.actor.session_id)) throw new Error('unsafe session token');
+if (record.actor_key !== serializeActor(record.actor)) throw new Error('actor_key differs from stored actor');
+NODE
+then pass "Codex assignment record stores one canonical privacy-safe struct/key"
+else fail "Codex assignment record did not store the canonical privacy-safe struct/key"
+fi
+if rg -qF 'PRIVATE-SENTINEL' "$CODEX_ROOT" "$TMPDIR_EVAL/codex-claim.json" "$TMPDIR_EVAL/codex-claim.err"; then
+  fail "raw CODEX_THREAD_ID sentinel leaked into assignment artifacts or command output"
+else
+  pass "raw CODEX_THREAD_ID sentinel is absent from the complete assignment artifact/output set"
+fi
+CODEX_KEY="$(json_query "$CODEX_RECORD" "actor_key")"
+CODEX_THREAD_ID="$CODEX_RAW" CODEX_SESSION_ID= node "$CLI" assignment-provider status \
+  --provider local-file --artifact-root "$CODEX_ROOT" --subject-id "$CODEX_SUBJECT" \
+  --liveness-events-json <(echo '[]') --self-actor "$CODEX_KEY" >"$TMPDIR_EVAL/codex-status.json"
+[[ "$(json_query "$TMPDIR_EVAL/codex-status.json" "effective.reason")" == "self_is_holder" ]] \
+  && pass "subsequent assignment status recognizes the canonical Codex actor as self" \
+  || fail "subsequent assignment status did not recognize the canonical Codex actor as self"
+
 if [[ "$errors" -eq 0 ]]; then
   echo "test_assignment_provider_local_file: all checks passed."
 else

package/evals/integration/test_builder_entry_enforcement.sh

@@ -478,7 +478,11 @@ else
   fail "preexisting assignment was treated as current selection evidence: $(cat "$TMP/preexisting.out")"
 fi
 
-if FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \
+# #440 FIXTURE-GAP: $TMP/local's session was established under FLOW_AGENTS_ACTOR=builder-entry-local
+# (see the "workflow start" call above) -- the Stop hook must run as that SAME actor so
+# stop-goal-fit.js's ownership-scoped analyze() finds builder-entry-local's own per-actor pointer
+# (established by workflow start's dual-write), not nothing for an unrelated ambient actor.
+if FLOW_AGENTS_ACTOR=builder-entry-local FLOW_AGENTS_GOAL_FIT_MODE=block FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000 \
   node "$ROOT/scripts/hooks/stop-goal-fit.js" >"$TMP/stop.out" 2>"$TMP/stop.err" <<JSON
 {"hook_event_name":"Stop","cwd":"$TMP/local"}
 JSON

package/evals/integration/test_bundle_install.sh

@@ -44,35 +44,94 @@ OPENCODE_DEST="$TMPDIR_EVAL/opencode-workspace"
 OPENCODE_CONSOLE_DEST="$TMPDIR_EVAL/opencode-console-workspace"
 OPENCODE_FULL_DEST="$TMPDIR_EVAL/opencode-full-workspace"
 PI_DEST="$TMPDIR_EVAL/pi-workspace"
+INSTRUCTION_FIXTURES="$TMPDIR_EVAL/instruction-fixtures"
 CONSOLE_TOKEN_FILE="$TMPDIR_EVAL/console-token"
 printf 'test-token\n' > "$CONSOLE_TOKEN_FILE"
 chmod 600 "$CONSOLE_TOKEN_FILE" 2>/dev/null || true
 
+instruction_fixture_key() {
+  printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+}
+
+instruction_file_identity() {
+  local file="$1"
+  printf '%s %s\n' "$(wc -c < "$file" | tr -d ' ')" "$(shasum -a 256 "$file" | awk '{print $1}')"
+}
+
+seed_instruction_fixture() {
+  local dest="$1"
+  local label="$2"
+  local key
+  key="$(instruction_fixture_key "$dest")"
+  mkdir -p "$dest" "$INSTRUCTION_FIXTURES"
+  printf '# Repository AGENTS instructions\nfixture=%s\nkind=agents\nliteral=__KIRO_PACKAGE_ROOT__\n' "$label" > "$dest/AGENTS.md"
+  printf '# Repository CLAUDE instructions\nfixture=%s\nkind=claude\nliteral=__KIRO_PACKAGE_ROOT__\n' "$label" > "$dest/CLAUDE.md"
+  instruction_file_identity "$dest/AGENTS.md" > "$INSTRUCTION_FIXTURES/$key.AGENTS.md.identity"
+  instruction_file_identity "$dest/CLAUDE.md" > "$INSTRUCTION_FIXTURES/$key.CLAUDE.md.identity"
+}
+
+assert_instruction_fixture_preserved() {
+  local dest="$1"
+  local label="$2"
+  local key filename expected actual
+  key="$(instruction_fixture_key "$dest")"
+  for filename in AGENTS.md CLAUDE.md; do
+    expected="$(cat "$INSTRUCTION_FIXTURES/$key.$filename.identity")"
+    if [[ -f "$dest/$filename" ]]; then
+      actual="$(instruction_file_identity "$dest/$filename")"
+    else
+      actual="missing"
+    fi
+    if [[ "$actual" == "$expected" ]]; then
+      _pass "$label preserves existing $filename byte-for-byte"
+    else
+      _fail "$label changed or deleted existing $filename (expected identity: $expected; actual: $actual)"
+    fi
+  done
+}
+
+# Every install path starts with distinct repository-owned instructions. Kiro's
+# fixture is intentionally at the rsync --delete destination root so deletion,
+# not only replacement, is covered by this regression test.
+seed_instruction_fixture "$KIRO_DEST" "direct-kiro-delete-sync"
+seed_instruction_fixture "$BASE_DEST" "direct-base"
+seed_instruction_fixture "$CLAUDE_DEST" "direct-claude-code"
+seed_instruction_fixture "$CODEX_DEST" "direct-codex"
+seed_instruction_fixture "$OPENCODE_DEST" "direct-opencode"
+seed_instruction_fixture "$PI_DEST" "direct-pi"
+seed_instruction_fixture "$BASE_INIT_DEST" "cli-base"
+seed_instruction_fixture "$CODEX_INIT_DEST" "cli-codex"
+seed_instruction_fixture "$OPENCODE_FULL_DEST" "cli-opencode"
+
 echo ""
 echo "--- Install ---"
-if (cd "$ROOT_DIR/dist/kiro" && bash install.sh "$KIRO_DEST" >/dev/null); then
+if (cd "$ROOT_DIR/dist/kiro" && bash install.sh "$KIRO_DEST/" >/dev/null); then
   _pass "Kiro install succeeded"
 else
   _fail "Kiro install failed"
 fi
+assert_instruction_fixture_preserved "$KIRO_DEST" "Kiro direct install with trailing-slash destination and rsync --delete"
 
 if (cd "$ROOT_DIR/dist/base" && bash install.sh "$BASE_DEST" >/dev/null); then
   _pass "Base install succeeded"
 else
   _fail "Base install failed"
 fi
+assert_instruction_fixture_preserved "$BASE_DEST" "Base direct install"
 
 if (cd "$ROOT_DIR/dist/claude-code" && bash install.sh "$CLAUDE_DEST" >/dev/null); then
   _pass "Claude Code install succeeded"
 else
   _fail "Claude Code install failed"
 fi
+assert_instruction_fixture_preserved "$CLAUDE_DEST" "Claude Code direct install"
 
 if (cd "$ROOT_DIR/dist/codex" && bash install.sh "$CODEX_DEST" >/dev/null); then
   _pass "Codex install succeeded"
 else
   _fail "Codex install failed"
 fi
+assert_instruction_fixture_preserved "$CODEX_DEST" "Codex direct install"
 
 if (cd "$ROOT_DIR/dist/codex" && bash install.sh "$CODEX_CONSOLE_DEST" --telemetry-sink local-kontour-console --console-token-file "$CONSOLE_TOKEN_FILE" --console-tenant tenant-a >/dev/null); then
   _pass "Codex install with Console telemetry config succeeded"
@@ -118,17 +177,19 @@ else
   _pass "Codex install rejects unsafe hosted Console http URL"
 fi
 
-if node "$ROOT_DIR/build/src/cli.js" init --dest "$BASE_INIT_DEST" --telemetry-sink local-kontour-console --yes >/dev/null; then
+if node "$ROOT_DIR/build/src/cli.js" init --runtime base --dest "$BASE_INIT_DEST" --telemetry-sink local-kontour-console --yes >/dev/null; then
   _pass "flow-agents init headless base install succeeded"
 else
   _fail "flow-agents init headless base install failed"
 fi
+assert_instruction_fixture_preserved "$BASE_INIT_DEST" "flow-agents init Base install"
 
 if node "$ROOT_DIR/build/src/cli.js" init --runtime codex --dest "$CODEX_INIT_DEST" --telemetry-sink local-kontour-console --console-tenant tenant-a --activate-kits --yes >/dev/null; then
   _pass "flow-agents init headless Codex install succeeded"
 else
   _fail "flow-agents init headless Codex install failed"
 fi
+assert_instruction_fixture_preserved "$CODEX_INIT_DEST" "flow-agents init Codex install"
 
 echo ""
 echo "--- Guided Console-Connect Wizard (G2/G3): headless regression + summary/verify ---"
@@ -266,6 +327,7 @@ if (cd "$ROOT_DIR/dist/opencode" && bash install.sh "$OPENCODE_DEST" >/dev/null)
 else
   _fail "opencode install failed"
 fi
+assert_instruction_fixture_preserved "$OPENCODE_DEST" "OpenCode direct install"
 
 if (cd "$ROOT_DIR/dist/opencode" && bash install.sh "$OPENCODE_CONSOLE_DEST" --telemetry-sink local-kontour-console --console-token-file "$CONSOLE_TOKEN_FILE" --console-tenant tenant-oc >/dev/null); then
   _pass "opencode install with Console telemetry config succeeded"
@@ -278,12 +340,14 @@ if node "$ROOT_DIR/build/src/cli.js" init --runtime opencode --dest "$OPENCODE_F
 else
   _fail "flow-agents init headless opencode install failed"
 fi
+assert_instruction_fixture_preserved "$OPENCODE_FULL_DEST" "flow-agents init OpenCode install"
 
 if (cd "$ROOT_DIR/dist/pi" && bash install.sh "$PI_DEST" >/dev/null); then
   _pass "pi install succeeded"
 else
   _fail "pi install failed"
 fi
+assert_instruction_fixture_preserved "$PI_DEST" "pi direct install"
 
 USER_SKILLS_DIR="$CODEX_FULL_DEST/.agents/sk""ills/user-skill"
 mkdir -p "$CODEX_FULL_DEST/.codex/ag""ents" "$USER_SKILLS_DIR"
@@ -323,7 +387,7 @@ done
 
 echo ""
 echo "--- Placeholder Rewriting ---"
-if rg -n '__KIRO_PACKAGE_ROOT__' "$KIRO_DEST" >/tmp/kiro-placeholder-leaks.txt 2>/dev/null; then
+if rg -n --glob '!AGENTS.md' --glob '!CLAUDE.md' '__KIRO_PACKAGE_ROOT__' "$KIRO_DEST" >/tmp/kiro-placeholder-leaks.txt 2>/dev/null; then
   _fail "Kiro install left placeholder tokens behind (see /tmp/kiro-placeholder-leaks.txt)"
 else
   _pass "Kiro install rewrote package root placeholders"
@@ -373,13 +437,13 @@ else
   _fail "flow-agents init did not persist Console config or activate Codex kits"
 fi
 
-if [[ -f "$BASE_INIT_DEST/AGENTS.md" ]] \
+if [[ -f "$BASE_INIT_DEST/README.md" ]] \
   && [[ -d "$BASE_INIT_DEST/.flow-agents" ]] \
   && [[ -d "$BASE_INIT_DEST/.kontourai/flow-agents" ]] \
   && rg -F -q "console_telemetry_url=$LOCAL_KONTOUR_CONSOLE_URL" "$BASE_INIT_DEST/scripts/telemetry/telemetry.conf"; then
-  _pass "flow-agents init default installs base AGENTS.md workspace contract"
+  _pass "flow-agents init default installs base documented workspace contract"
 else
-  _fail "flow-agents init default did not install base AGENTS.md workspace contract"
+  _fail "flow-agents init default did not install base documented workspace contract"
 fi
 
 if rg -F -q "console_telemetry_url=$LOCAL_KONTOUR_CONSOLE_URL" "$OPENCODE_CONSOLE_DEST/scripts/telemetry/telemetry.conf" \
@@ -636,11 +700,18 @@ fi
 
 KIRO_WORKSPACE="$TMPDIR_EVAL/kiro-workspace"
 mkdir -p "$KIRO_WORKSPACE"
-if node - "$CLAUDE_DEST" "$CODEX_DEST" "$KIRO_DEST" "$KIRO_WORKSPACE" <<'NODE'
+if node - "$CLAUDE_DEST" "$CODEX_DEST" "$KIRO_DEST" "$KIRO_WORKSPACE" "$ROOT_DIR/scripts/hooks/lib/current-pointer.js" <<'NODE'
 const fs = require("node:fs");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
-const [claudeDest, codexDest, kiroDest, kiroWorkspace] = process.argv.slice(2);
+const [claudeDest, codexDest, kiroDest, kiroWorkspace, currentPointerHelperPath] = process.argv.slice(2);
+const { writePerActorCurrent } = require(currentPointerHelperPath);
+// #440 FIXTURE-GAP: this fixture was written before #440's per-actor ownership scoping and never
+// established a per-actor current pointer for the invoking actor -- under a RESOLVED ambient
+// actor, workflow-steering.js's actorScopedWorkflowState now scopes to that actor's own
+// (nonexistent) pointer and never surfaces the WORKFLOW STATE ATTENTION banner. Give each
+// runCommand invocation a stable, explicit actor below (see FLOW_AGENTS_ACTOR in env).
+const installedHookActor = "eval-actor-bundle-install-installed-hook";
 const state = {
   schema_version: "1.0",
   task_slug: "installed-hook-demo",
@@ -661,6 +732,10 @@ function writeFixture(root) {
   fs.writeFileSync(path.join(taskDir, "trust.bundle"), JSON.stringify(trustBundle), "utf8");
   fs.mkdirSync(path.join(root, "docs"), { recursive: true });
   fs.writeFileSync(path.join(root, "docs/context-map.md"), "# Context Map\n", "utf8");
+  const flowAgentsDir = path.join(root, ".kontourai/flow-agents");
+  const currentPayload = { schema_version: "1.0", active_slug: "installed-hook-demo", artifact_dir: "installed-hook-demo" };
+  fs.writeFileSync(path.join(flowAgentsDir, "current.json"), JSON.stringify(currentPayload, null, 2) + "\n");
+  writePerActorCurrent(flowAgentsDir, installedHookActor, currentPayload);
 }
 function eventGroups(file, ...names) {
   const hooks = JSON.parse(fs.readFileSync(file, "utf8")).hooks || {};
@@ -683,7 +758,7 @@ function workflowCommand(file, ...eventNames) {
 }
 function runCommand(label, command, cwd, runtimeJson) {
   const payload = JSON.stringify({ hook_event_name: "UserPromptSubmit", cwd, prompt: "continue" });
-  const env = { ...process.env, SA_HOOK_PROFILE: "standard", CLAUDE_PROJECT_DIR: cwd };
+  const env = { ...process.env, SA_HOOK_PROFILE: "standard", CLAUDE_PROJECT_DIR: cwd, FLOW_AGENTS_ACTOR: installedHookActor };
   if (label === "Codex") env.CODEX_HOME = cwd;
   const result = spawnSync(command, { input: payload, cwd, env, shell: true, encoding: "utf8", timeout: 30000 });
   if (result.status !== 0) throw new Error(`${label} installed hook failed: rc=${result.status} stdout=${result.stdout} stderr=${result.stderr}`);
@@ -709,11 +784,14 @@ fi
 # Execute the opencode plugin's workflow-steering command path directly
 OPENCODE_WORKSPACE="$TMPDIR_EVAL/opencode-exec-workspace"
 mkdir -p "$OPENCODE_WORKSPACE"
-if node - "$OPENCODE_DEST" "$OPENCODE_WORKSPACE" <<'NODE'
+if node - "$OPENCODE_DEST" "$OPENCODE_WORKSPACE" "$ROOT_DIR/scripts/hooks/lib/current-pointer.js" <<'NODE'
 const fs = require("node:fs");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
-const [opencodeDest, opencodeWorkspace] = process.argv.slice(2);
+const [opencodeDest, opencodeWorkspace, currentPointerHelperPath] = process.argv.slice(2);
+const { writePerActorCurrent } = require(currentPointerHelperPath);
+// #440 FIXTURE-GAP: see the installed-prompt-submit block above for the full rationale.
+const opencodeHookActor = "eval-actor-bundle-install-opencode-hook";
 const state = {
   schema_version: "1.0",
   task_slug: "opencode-hook-demo",
@@ -730,6 +808,10 @@ function writeFixture(root) {
   fs.writeFileSync(path.join(taskDir, "trust.bundle"), JSON.stringify(trustBundle), "utf8");
   fs.mkdirSync(path.join(root, "docs"), { recursive: true });
   fs.writeFileSync(path.join(root, "docs/context-map.md"), "# Context Map\n", "utf8");
+  const flowAgentsDir = path.join(root, ".kontourai/flow-agents");
+  const currentPayload = { schema_version: "1.0", active_slug: "opencode-hook-demo", artifact_dir: "opencode-hook-demo" };
+  fs.writeFileSync(path.join(flowAgentsDir, "current.json"), JSON.stringify(currentPayload, null, 2) + "\n");
+  writePerActorCurrent(flowAgentsDir, opencodeHookActor, currentPayload);
 }
 function runOpencodeAdapter(bundleDest, cwd) {
   const adapterPath = path.join(bundleDest, "scripts", "hooks", "opencode-hook-adapter.js");
@@ -737,7 +819,7 @@ function runOpencodeAdapter(bundleDest, cwd) {
   const result = spawnSync(process.execPath, [adapterPath, "UserPromptSubmit", "workflow-steering", "workflow-steering.js", "default"], {
     input: payload,
     cwd,
-    env: { ...process.env, SA_HOOK_PROFILE: "standard", FLOW_AGENTS_HOOK_RUNTIME: "opencode" },
+    env: { ...process.env, SA_HOOK_PROFILE: "standard", FLOW_AGENTS_HOOK_RUNTIME: "opencode", FLOW_AGENTS_ACTOR: opencodeHookActor },
     encoding: "utf8",
     timeout: 30000,
   });
@@ -761,11 +843,14 @@ fi
 # Execute the pi extension's hook adapter command path directly
 PI_WORKSPACE="$TMPDIR_EVAL/pi-exec-workspace"
 mkdir -p "$PI_WORKSPACE"
-if node - "$PI_DEST" "$PI_WORKSPACE" <<'NODE'
+if node - "$PI_DEST" "$PI_WORKSPACE" "$ROOT_DIR/scripts/hooks/lib/current-pointer.js" <<'NODE'
 const fs = require("node:fs");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
-const [piDest, piWorkspace] = process.argv.slice(2);
+const [piDest, piWorkspace, currentPointerHelperPath] = process.argv.slice(2);
+const { writePerActorCurrent } = require(currentPointerHelperPath);
+// #440 FIXTURE-GAP: see the installed-prompt-submit block above for the full rationale.
+const piHookActor = "eval-actor-bundle-install-pi-hook";
 const state = {
   schema_version: "1.0",
   task_slug: "pi-hook-demo",
@@ -782,6 +867,10 @@ function writeFixture(root) {
   fs.writeFileSync(path.join(taskDir, "trust.bundle"), JSON.stringify(trustBundle), "utf8");
   fs.mkdirSync(path.join(root, "docs"), { recursive: true });
   fs.writeFileSync(path.join(root, "docs/context-map.md"), "# Context Map\n", "utf8");
+  const flowAgentsDir = path.join(root, ".kontourai/flow-agents");
+  const currentPayload = { schema_version: "1.0", active_slug: "pi-hook-demo", artifact_dir: "pi-hook-demo" };
+  fs.writeFileSync(path.join(flowAgentsDir, "current.json"), JSON.stringify(currentPayload, null, 2) + "\n");
+  writePerActorCurrent(flowAgentsDir, piHookActor, currentPayload);
 }
 function runPiAdapter(bundleDest, cwd) {
   const adapterPath = path.join(bundleDest, "scripts", "hooks", "pi-hook-adapter.js");
@@ -789,7 +878,7 @@ function runPiAdapter(bundleDest, cwd) {
   const result = spawnSync(process.execPath, [adapterPath, "UserPromptSubmit", "workflow-steering", "workflow-steering.js", "default"], {
     input: payload,
     cwd,
-    env: { ...process.env, SA_HOOK_PROFILE: "standard", FLOW_AGENTS_HOOK_RUNTIME: "pi" },
+    env: { ...process.env, SA_HOOK_PROFILE: "standard", FLOW_AGENTS_HOOK_RUNTIME: "pi", FLOW_AGENTS_ACTOR: piHookActor },
     encoding: "utf8",
     timeout: 30000,
   });
@@ -890,11 +979,11 @@ NODE
 )"
 
 package_flow() {
-  (cd "$PACKAGE_PROJECT" && CODEX_SESSION_ID=packed-package-consumer node "$PACKAGE_CLI" workflow "$@")
+  (cd "$PACKAGE_PROJECT" && env -u CODEX_THREAD_ID CODEX_SESSION_ID=packed-package-consumer node "$PACKAGE_CLI" workflow "$@")
 }
 
 package_review() {
-  (cd "$PACKAGE_PROJECT" && CODEX_SESSION_ID=packed-package-reviewer node "$PACKAGE_CLI" workflow "$@")
+  (cd "$PACKAGE_PROJECT" && env -u CODEX_THREAD_ID CODEX_SESSION_ID=packed-package-reviewer node "$PACKAGE_CLI" workflow "$@")
 }
 
 if (cd "$ROOT_DIR" && npm pack --silent --pack-destination "$TMPDIR_EVAL" >"$PACKAGE_PACK_LOG") \

package/evals/integration/test_bundle_lifecycle.sh

@@ -528,11 +528,11 @@ fi
 DOGFOOD_WORKSPACE="$CLAUDE_IDEM"  # reuse the installed workspace from the idempotent section
 mkdir -p "$DOGFOOD_WORKSPACE/.kontourai/flow-agents"
 
-if node - "$DOGFOOD_DEST2/.claude/settings.json" "$DOGFOOD_WORKSPACE" << 'NODE'
+if node - "$DOGFOOD_DEST2/.claude/settings.json" "$DOGFOOD_WORKSPACE" "$ROOT_DIR/scripts/hooks/lib/current-pointer.js" << 'NODE'
 const fs = require("node:fs");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
-const [settingsPath, workspace] = process.argv.slice(2);
+const [settingsPath, workspace, currentPointerHelperPath] = process.argv.slice(2);
 
 // Write minimal fixtures for workflow-steering into the workspace
 const taskDir = path.join(workspace, ".kontourai", "flow-agents", "dogfood-hook-demo");
@@ -583,10 +583,24 @@ for (const group of groups) {
 }
 if (!wsCommand) throw new Error("workflow-steering hook command not found");
 
+// #440 FIXTURE-GAP: this fixture was written before #440's per-actor ownership scoping and
+// never established a per-actor current pointer for the invoking actor -- under a RESOLVED
+// ambient actor (ancestry-derived locally, GITHUB_RUN_ID-derived CI-runtime in CI),
+// workflow-steering.js's actorScopedWorkflowState now scopes to that actor's own (nonexistent)
+// pointer and never surfaces the WORKFLOW STATE ATTENTION banner. Give the hook a stable,
+// explicit actor and seed that actor's own per-actor pointer for dogfood-hook-demo, mirroring
+// workflow-sidecar.ts's real writeCurrent() dual-write via current-pointer.js's own
+// writePerActorCurrent.
+const dogfoodActor = "eval-actor-bundle-lifecycle-dogfood";
+const flowAgentsDir = path.join(workspace, ".kontourai", "flow-agents");
+const currentPayload = { schema_version: "1.0", active_slug: "dogfood-hook-demo", artifact_dir: "dogfood-hook-demo" };
+fs.writeFileSync(path.join(flowAgentsDir, "current.json"), JSON.stringify(currentPayload, null, 2) + "\n");
+require(currentPointerHelperPath).writePerActorCurrent(flowAgentsDir, dogfoodActor, currentPayload);
+
 // Execute the hook. CLAUDE_PROJECT_DIR must point to the workspace that has scripts/hooks/.
 // In the real dogfood use case this is the repo root; here we use the installed test workspace.
 const payload = JSON.stringify({ hook_event_name: "UserPromptSubmit", cwd: workspace, prompt: "continue" });
-const env = { ...process.env, SA_HOOK_PROFILE: "standard", CLAUDE_PROJECT_DIR: workspace };
+const env = { ...process.env, SA_HOOK_PROFILE: "standard", CLAUDE_PROJECT_DIR: workspace, FLOW_AGENTS_ACTOR: dogfoodActor };
 const result = spawnSync(wsCommand, {
   input: payload,
   cwd: workspace,

package/evals/integration/test_captured_fail_reconciliation.sh

@@ -29,6 +29,17 @@ set -uo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 GATE="$ROOT/scripts/hooks/stop-goal-fit.js"
 
+# #440 FIXTURE-GAP: this suite's fixtures were written before #440's per-actor ownership scoping
+# and never establish a per-actor current pointer for the invoking actor -- under a RESOLVED
+# ambient actor (ancestry-derived locally, GITHUB_RUN_ID-derived CI-runtime in CI), stop-goal-fit.js's
+# analyze() now scopes to that actor's own (nonexistent) pointer and never reaches the
+# fixture-under-test at all. This suite is about anti-gaming/gate mechanics, not #440's ownership
+# scoping, so forcing the documented test-only unresolved-actor escape hatch restores EXACTLY this
+# suite's pre-#440 behavior (D3 compat: an unresolved actor keeps the unchanged legacy-fallback/
+# global-scan discovery every assertion below was written against).
+export FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1
+export NODE_ENV=test
+
 export FLOW_AGENTS_GOAL_FIT_MAX_BLOCKS=100000
 
 TMP="$(mktemp -d)"

package/evals/integration/test_ci_actor_identity.sh

@@ -60,7 +60,7 @@ process.stdout.write(process.argv[2] === "source" ? r.source : r.actor);
 verify_hold_under_ci() {
   local dir="$1"; shift
   (
-    unset FLOW_AGENTS_ACTOR CLAUDE_CODE_SESSION_ID CODEX_SESSION_ID OPENCODE_SESSION_ID PI_SESSION_ID CLAUDECODE
+    unset FLOW_AGENTS_ACTOR CLAUDE_CODE_SESSION_ID CODEX_THREAD_ID CODEX_SESSION_ID OPENCODE_SESSION_ID PI_SESSION_ID CLAUDECODE
     while [[ $# -gt 0 ]]; do export "${1?}"; shift; done
     flow_agents_node "$WRITER" verify-hold "$dir"
   )
@@ -150,7 +150,7 @@ CLI="$ROOT/build/src/cli.js"
 RT_ROOT="$TMPDIR_EVAL/rt-artifact-root"
 RT_SLUG="ci-roundtrip"
 (
-  unset FLOW_AGENTS_ACTOR CLAUDE_CODE_SESSION_ID CODEX_SESSION_ID OPENCODE_SESSION_ID PI_SESSION_ID CLAUDECODE
+  unset FLOW_AGENTS_ACTOR CLAUDE_CODE_SESSION_ID CODEX_THREAD_ID CODEX_SESSION_ID OPENCODE_SESSION_ID PI_SESSION_ID CLAUDECODE
   export "${GHA[@]}"
   node "$CLI" assignment-provider claim --provider local-file --artifact-root "$RT_ROOT" \
     --subject-id "$RT_SLUG" --branch main --artifact-dir "$RT_SLUG"

package/evals/integration/test_command_log_concurrency.sh

@@ -18,6 +18,17 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# #440 FIXTURE-GAP: this suite's fixtures were written before #440's per-actor ownership scoping
+# and never establish a per-actor current pointer for the invoking actor -- under a RESOLVED
+# ambient actor (ancestry-derived locally, GITHUB_RUN_ID-derived CI-runtime in CI), stop-goal-fit.js's
+# analyze() now scopes to that actor's own (nonexistent) pointer and never reaches the
+# fixture-under-test at all. This suite is about anti-gaming/gate mechanics, not #440's ownership
+# scoping, so forcing the documented test-only unresolved-actor escape hatch restores EXACTLY this
+# suite's pre-#440 behavior (D3 compat: an unresolved actor keeps the unchanged legacy-fallback/
+# global-scan discovery every assertion below was written against).
+export FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1
+export NODE_ENV=test
 CAPTURE="$ROOT/scripts/hooks/evidence-capture.js"
 GATE="$ROOT/scripts/hooks/stop-goal-fit.js"
 

package/evals/integration/test_command_log_fork_classification.sh

@@ -15,6 +15,17 @@ set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 export GATE="$ROOT/scripts/hooks/stop-goal-fit.js"
+
+# #440 FIXTURE-GAP: this suite's fixtures were written before #440's per-actor ownership scoping
+# and never establish a per-actor current pointer for the invoking actor -- under a RESOLVED
+# ambient actor (ancestry-derived locally, GITHUB_RUN_ID-derived CI-runtime in CI), stop-goal-fit.js's
+# analyze() now scopes to that actor's own (nonexistent) pointer and never reaches the
+# fixture-under-test at all. This suite is about anti-gaming/gate mechanics, not #440's ownership
+# scoping, so forcing the documented test-only unresolved-actor escape hatch restores EXACTLY this
+# suite's pre-#440 behavior (D3 compat: an unresolved actor keeps the unchanged legacy-fallback/
+# global-scan discovery every assertion below was written against).
+export FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1
+export NODE_ENV=test
 REPAIR="$ROOT/scripts/repair-command-log.js"
 
 TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

package/evals/integration/test_command_log_integrity.sh

@@ -16,6 +16,17 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# #440 FIXTURE-GAP: this suite's fixtures were written before #440's per-actor ownership scoping
+# and never establish a per-actor current pointer for the invoking actor -- under a RESOLVED
+# ambient actor (ancestry-derived locally, GITHUB_RUN_ID-derived CI-runtime in CI), stop-goal-fit.js's
+# analyze() now scopes to that actor's own (nonexistent) pointer and never reaches the
+# fixture-under-test at all. This suite is about anti-gaming/gate mechanics, not #440's ownership
+# scoping, so forcing the documented test-only unresolved-actor escape hatch restores EXACTLY this
+# suite's pre-#440 behavior (D3 compat: an unresolved actor keeps the unchanged legacy-fallback/
+# global-scan discovery every assertion below was written against).
+export FLOW_AGENTS_ACTOR_TEST_FORCE_UNRESOLVED=1
+export NODE_ENV=test
 CAPTURE="$ROOT/scripts/hooks/evidence-capture.js"
 GATE="$ROOT/scripts/hooks/stop-goal-fit.js"